Shadow AI Is Already in Your Building: Detection and Containment

Sixty-nine percent of organizations suspect or have confirmed that employees use prohibited public AI tools, according to a Gartner survey of 302 cybersecurity leaders conducted in spring 2025 [1]. The shadow AI enterprise risk is not a forecast. It is a measured condition, and it sits inside firms with AI policies, firms with DLP, and firms whose executives believe they banned ChatGPT two years ago.

This piece is for the CISO or CIO who needs to know three things: how big the exposure actually is, how to see it without standing up a new surveillance program, and how to contain it in a way that survives contact with your workforce. Everything below is sourced, and the detection runbook at the end works with telemetry you almost certainly already collect.

How big is the shadow AI enterprise risk?

The surveys disagree on the exact number. They do not disagree on the order of magnitude.

Read the Verizon number carefully. The problem is not that employees use AI. It is that most of them use it through identities your SSO, your DLP, and your audit log never see. IBM's Cost of a Data Breach Report 2025 found shadow AI was a factor in 20% of breaches, added $670,000 to the average breach cost, and that 97% of organizations with an AI-related incident lacked proper AI access controls [6]. The data most often compromised in those breaches: customer PII (65%) and intellectual property (40%) [6].

Gartner expects that by 2030, more than 40% of enterprises will face a security or compliance incident tied to unauthorized shadow AI [1]. A prediction, not a measurement. But the direction has only one sign.

What employees actually paste, and what it costs

Telemetry makes the abstract concrete. Netskope's Cloud and Threat Report 2026, drawn from anonymized traffic across millions of users, puts the average organization at 223 GenAI-linked data policy violations per month, rising to 2,100 per month in the top quartile of AI adopters. Source code accounts for 42% of violations, regulated data (customer records, financial information, healthcare data) for 32%, and intellectual property for 16% [7]. The average organization now sends roughly 18,000 prompts a month to GenAI tools, up from about 3,000 a year earlier [7].

The canonical incident remains Samsung, 2023: three separate leaks in under 20 days after semiconductor engineers pasted source code, test sequences, and meeting notes into ChatGPT [8]. Samsung's response, a company-wide ban, became the template most regulated firms still reach for. We will come back to how that ended, because it ended in a reversal.

For a regulated firm, the regulatory mapping is direct. A prompt containing PHI sent to a consumer LLM with no BAA is a HIPAA reportable event waiting for discovery. Client financial data pasted into an unapproved tool sits outside your FINRA and SEC recordkeeping perimeter. OWASP catalogs this entire class as LLM02:2025, Sensitive Information Disclosure [9].

Detection: three telemetry layers, none optional

You do not need a new platform to establish a baseline. You need to query three data sources you already pay for.

Network and DNS. Your proxy, firewall, or secure web gateway logs every domain your fleet resolves. AI tools have a small, enumerable destination set: chat.openai.com, claude.ai, gemini.google.com, copilot.microsoft.com, perplexity.ai, plus a long tail of wrappers and vertical tools. Pull 90 days of DNS and proxy logs, classify destinations, and you have your first inventory: which tools, how many distinct users, what volume. This layer sees everything on the corporate network and nothing off it.

Expense and accounts payable. Shadow AI has a paper trail: $20 ChatGPT Plus charges on corporate cards, Anthropic and Midjourney line items in expense reports, SaaS subscriptions bought on a manager's card because procurement took six weeks. Search AP and card feeds for the top 50 AI vendor names. Every match is a tool in production use that never passed security review. This layer catches what network telemetry misses, including tools used from home.

Browser and endpoint. Most GenAI use happens in the browser, and the sensitive act is the paste, not the visit. Browser extension telemetry and endpoint DLP can see prompt content, file uploads to AI domains, and which account (corporate or personal) is logged in. This is the only layer that distinguishes "visited claude.ai" from "uploaded the Q3 board deck to a personal account." It is also the most invasive, and the one employees will push back on hardest.

No single layer is sufficient. Network data without expense data misses the paid tools your top performers bought themselves. Endpoint data without network data misses scale. Together they triangulate.

Containment that channels instead of bans

Here is what the ban path looks like end to end. Samsung banned ChatGPT in May 2023 after the leaks. Three years later, in June 2026, Samsung reversed the ban entirely and deployed ChatGPT Enterprise and Codex to more than 120,000 employees, in one of OpenAI's largest enterprise rollouts [8]. The ban did not eliminate demand. It deferred the decision.

The telemetry supports the channeling model. Netskope reports that the share of AI users on personal applications fell from 78% to 47% globally between 2024 and 2025 as organizations deployed managed alternatives. In Japan, where firms pushed managed tools aggressively, personal GenAI use dropped from 85% to 11% in one year [10]. Employees do not insist on the consumer tool. They insist on the capability. Give them a sanctioned path that is roughly as good, and most of them take it.

The architecture that makes this work is the Gateway Chokepoint: one approved path (an AI gateway or brokered enterprise accounts) where identity, logging, data classification, and policy enforcement live, with consumer destinations blocked at the proxy for managed devices. The gateway is not a wall. It is the instrumented lane, priced and provisioned so the uninstrumented lanes lose their reason to exist. We have written about the gateway pattern in AI gateway architecture and about controlling what leaves your perimeter in AI egress control in your VPC. Policy still matters, but as code, not as a PDF: see policy as code for AI acceptable use.

The 30-day shadow AI baseline

A runbook you can start Monday with existing telemetry:

• Week 1: Network inventory. Query 90 days of DNS/proxy logs against a maintained list of AI domains. Output: tool list, distinct user count, traffic volume by tool.
• Week 2: Money trail. Search AP and corporate card feeds for AI vendor charges. Cross-reference against the network list. Discrepancies are tools used off-network or paid personally.
• Week 3: Triage, not punishment. Classify findings by data sensitivity, not by tool. A marketing coordinator using a free image tool is not the same exposure as an analyst pasting client portfolios. Announce an amnesty window: self-report your tools, no consequences, and tell us what approved alternative you need.
• Week 4: Channel. Stand up or contract the sanctioned path for the top three use cases you found. Set the proxy policy. Publish the one-page rule: what data classes may never leave, and where everything else goes.

Output you keep: a living inventory, a sensitivity-ranked exposure list, and a demand signal for which capabilities to fund.

The case against: detection is the wrong investment

The strongest critique of this entire agenda deserves a fair hearing.

First, the numbers are softer than they look. The Cloud Security Alliance notes that most shadow AI statistics come from vendor telemetry and vendor-sponsored research, meaning they are measured on organizations that already bought monitoring tools. Rates elsewhere may differ, and vendors selling shadow AI detection have an obvious interest in the size of the number [11]. The Gartner figures are self-reported suspicion, not packet captures.

Second, and sharper: MIT NANDA's research found the shadow AI economy often delivers better returns than official initiatives. Employees cross the value gap with flexible consumer tools while sanctioned pilots stall. From this view, shadow AI is not a security failure. It is a procurement failure with a security symptom. Spending your first dollar on detection, the argument goes, means paying to surveil your most productive people for solving a problem your IT process created. The fix is better tools faster, not better monitoring.

Third, detection creates illusions. The 72% of GenAI users on non-corporate accounts [4] can take the whole workflow to a personal phone, where your three telemetry layers see nothing. A clean dashboard can mean containment. It can also mean the traffic moved to a place with zero visibility. Netskope's own framing cuts both ways: organizations without controls record zero detections, which is not the same as zero violations [7].

Our read

The critics are right that surveillance without an alternative is theater, and right that the headline numbers carry vendor bias. They are wrong that this makes detection optional.

The telemetry layers above are not a product purchase. They are queries against logs you already retain, and their first output is not an enforcement list. It is the demand signal the MIT research says you should listen to: which capabilities your people actually want, ranked by how badly they want them. Detection is how you find out what to build. Containment is how you make the sanctioned path the easy path. In a regulated industry there is a third reason neither side can argue with: when the examiner or the auditor asks where client data went, "we did not look" is not an answer. The audit trail is not overhead. It is the license to operate.

What this means for you

• Finance: The 20% of breaches involving shadow AI disproportionately expose customer PII [6], and unapproved tools sit outside your SEC and FINRA recordkeeping perimeter. Your Week 2 expense query will find paid AI tools your supervision system has never archived a single message from.
• Healthcare: A single prompt containing PHI to a consumer LLM with no BAA is a reportable event. Prioritize the browser/endpoint layer for clinical and billing staff first, and stand up a sanctioned, BAA-covered alternative before you block anything, or the traffic goes to personal phones.
• Legal: Client matter data in a consumer tool is a privilege problem, not just a confidentiality problem. The amnesty-window approach matters most here: fee earners will not volunteer their workflows if the first response is discipline.
• CPA and advisory: Client tax and financial data pasted into unapproved tools violates confidentiality obligations your engagement letters already promise. The 30-day baseline doubles as evidence for your next SOC 2 or client security questionnaire.

Start with the queries, not the policy rewrite. You cannot govern what you have not counted.

Book a free assessment: systemics.ai.

References

1. "Gartner Identifies 5 Critical Generative AI Blind Spots," Process Excellence Network (reporting Gartner survey of 302 cybersecurity leaders), November 2025. https://www.processexcellencenetwork.com/ai/news/gartner-identifies-5-critical-generative-ai-blind-spots
2. "Shadow AI Is Already in the Building: How to See the New Attack Surface," Anzenna (citing Gartner survey of 175 employees), June 2026. https://www.anzenna.ai/blog/shadow-ai-is-already-in-the-building/
3. "The GenAI Divide: State of AI in Business 2025," MIT Project NANDA, July 2025. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
4. "2025 Data Breach Investigations Report," Verizon, 2025. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
5. "The State of Shadow AI," UpGuard, 2025. https://www.upguard.com/resources/the-state-of-shadow-ai
6. "Cost of a Data Breach Report 2025," IBM Security, July 2025. https://www.ibm.com/reports/data-breach
7. "The AI Security Challenge, Answered" and "Cloud and Threat Report 2026," Netskope Threat Labs, 2026. https://www.netskope.com/the-ai-security-challenge-answered
8. "Samsung reverses years-long ban on external gen AI use," CIO, June 2026. https://www.cio.com/article/4184660/samsung-which-previously-blocked-chatgpt-is-now-fully-adopting-three-generative-ai-models-and-accelerating-its-ax-initiative.html
9. "LLM02:2025 Sensitive Information Disclosure," OWASP Top 10 for LLM Applications, 2025. https://genai.owasp.org/llmrisk/llm02-sensitive-information-disclosure/
10. "Netskope Threat Labs Report: Japan 2026," Netskope, February 2026. https://www.netskope.com/resources/threat-labs-reports/threat-labs-report-japan-2026
11. "Shadow AI Apps: The Enterprise Attack Surface That Outpaces Monitoring," Cloud Security Alliance Research, May 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-shadow-ai-apps-enterprise-20260530-csa-sty/